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Abstract. A (t, n)-threshold secret sharing scheme is a method to distribute a secret 
among n participants in such a way that any t participants can recover the secret, but 
no t — 1 participants can. In this paper, we propose two secret sharing schemes using 
non-abelian groups. One scheme is the special case where all the participants must 
get together to recover the secret. The other one is a (t, n)-threshold scheme that is a 
combination of Shamir's scheme and the group-theoretic scheme proposed in this paper. 
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1. Introduction 



Suppose one would like to distribute a secret among n participants in such a way that 
any t of the participants can recover the secret, but no group of t — 1 participants can. A 
method that allows one to do this is called a (t, n)-threshold scheme. Shamir [7J back in 
j^. , 1979 offered a (t, n)-threshold scheme that utilizes polynomial interpolation. In Shamir's 

I/"") ' scheme the secret is an element x € Z p . In order to distribute the secret, the dealer begins 

by choosing a polynomial / of degree t — 1 such that /(0) = x. Then he sends the value 
x i = f(i) secretly to participant P\. In order for the participants to recover the secret, 
they use polynomial interpolation to recover / and hence the secret f(0). In this setting, 
, no t — 1 participants can gain any information about the secret while any t of them can 

(see [7J or [8]). 

The field of non-commutative group-based cryptography has produced many new cryp- 
tographic protocols over the last decade or so. We refer an interested reader to [1] or 
P] for a survey of developments in this area. Recently, Panagopoulos [6] suggested a 
d • (t, n)-threshold scheme using group presentations and the word problem. His scheme is 

two-stage: at the first stage, long-term private information (defining relations of groups) 
is distributed to all participants over secure channels. At the second stage, shares of the 
actual secret are distributed to participants over open channels. Thus, an advantage of 
Panagopoulos' scheme over Shamir's scheme is that the actual secret need not be dis- 
tributed over secure channels. This is obviously useful in various real-life scenarios. On 
the other hand, his scheme is not quite practical because in his scheme, it takes time 
exponential in n to distribute the shares of a secret to n participants. 

In this paper, we present two practical secret sharing schemes based on group presen- 
tations and the word problem. The first one is a two-stage scheme, like the one due to 
Panagopoulos mentioned above, but it is just an (n, n)-threshold scheme. Our second 
scheme is a (t, n)-threshold scheme, < t < n. Both our schemes are designed for the 
scenario where the dealer and participants initially are able to communicate over secure 
channels, but afterwards they communicate over open channels. 
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We first consider the special (trivial) case where t = n; that is, we propose a scheme in 
which all participants are needed to recover the secret. Then, we propose a hybrid scheme 
that combines Shamir's scheme and the idea of the (n, n)-threshold scheme we proposed. 
This combined scheme has the same distributed secret as Shamir's scheme does, but rather 
than sending f(i) = X{ over secure channels we send the integers in disguise, and then 
participants use group-theoretic methods to recover the integers. This scheme has the 
following useful advantages over Shamir's scheme: 

• The actual secret need not be distributed over secure channels and, furthermore, 
once the long-term private information is distributed to all participants, several 
different secrets can be distributed without updating the long-term private infor- 
mation. 

• While recovering the secret, participants do not have to reveal their shares to each 
other if they do not want to. 

2. Very Brief Background on Group Theory 

In this section, we give a minimum of information and notation from group theory 
necessary to understand our main Sections [3] and [U Further facts from group theory that 
are used, explicitly or implicitly, in this paper are collected in Sections [6] and [3 

A free group F = F m of rank m, generated by X = {x±, . . . ,x m }, is the set of all 
reduced words in the alphabet {xf 1 , . . . ,x^}, where a word is called reduced if it does 
not have subwords of the form XjX" 1 or x~ 1 Xi. 

Any m-generated group G is a factor group of F m by some normal subgroup N. If there 
is a recursive (better yet, finite) set of elements {ri, . . . , r^, . . . , } of N that generate N 
as a normal subgroup of F m , then we use a compact description of G by generators and 
defining relators: 

G= (xx,... } x m | ri,...,r fc ,...,) 

and call {x\, . . . , x m } generators of G, and {n, . . . , r&, . . . , } defining relators of G. Here 
"generate N as a normal subgroup of F m " means that every element u oi N can be written 
as a (finite) product of conjugates of relators rf u = \\ k l\ 1 ri k hk- 

Given a presentation of a group G as above, the word problem for this presentation is: 
given a word w = w(xf 1 , . . . , x^ 1 ) in the generators of G, find out whether or not w € N. 
(If w € N, we say that w = 1 in G.) 

3. An (n, n)-THRESHOLD Scheme 

Suppose we would like the dealer to distribute a /c-column (7=1.1 consisting of O's 

and l's among n participants in such a way that the vector can be retrieved only when all 
n participants cooperate. We begin by making a set of group generators X = {x±, . . . , x m } 
public. The scheme is as follows: 

(1) The dealer distributes over a secure channel to each participant Pj a set of words Rj 

in the alphabet X ±l = {xf 1 , . . . , x^ 1 } such that each group Gj = {x± , . . . , x m j Rj) 

has efficiently solvable word problem. 
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(2) The dealer splits the secret bit column C (the actual secret to be shared) into a 

n 

sum C = Cj °f n bit columns; these are secret shares to be distributed. 

i=i 

(3) The dealer then distributes words w±j, . . . , Wkj in the generators x\, . . . , x m over 
an open channel to each participant Pj, 1 < j < n. The words are chosen so that 
Wij ^ 1 in Gj if Cj = and Wij = 1 in Gj if Cj = 1. 

(4) Participant Pj then checks, for each i, whether the word = 1 in Gj or not. 



After that, each participant Pj can make a column of O's and l's, C, 



by setting Cij = 1 if Wij = 1 in Gj and otherwise. 
(5) The participants then construct the secret by forming the column vector C 



E 



Cj, where the sum of the entries is taken modulo 2. 



3=1 

In Step (5) of the above protocol, the participants can use secure computation of a 
sum as proposed in [2] if they do not want to reveal their individual column vectors, and 
therefore their individual secret shares, to each other. In order to implement the protocol 
to compute a secure sum, the participants should be able to communicate over secure 
channels with one another. These secure channels should be arranged in a circuit, say, 
Pi — >■ Pi — > . . . — > P n — >• Pi. Then the protocol to compute a secure sum is as follows: 

(1) Pi begins the process by choosing a random column vector N±. He then sends to 
P 2 the sum N\ + C\. 

(2) Each Pj, for 2 < i < n — 1, does the following. Upon receiving a column vector 
C from participant Pj_i, each participant Pj chooses a random column vector N{ 
and adds iVj + Cj to C and sends the result to Pj+i. 

(3) Participant P n chooses a random column vector iV„ and adds N n + C n to the 
column he has received from P n _i and sends the result to Pi. Now Pi has the 



column vector ^^(iVj + Cj). 



(4) Participant Pi subtracts Ni from what he got from P n ; the result now is the sum 
5 = Y^i<i<k^i + Yl,2<i<k^'i- (This step is needed for Pi to preserve privacy of 
his N\, and therefore of his C\, since Pj knows iVi + Ci.) Then Pi broadcasts S 
to other participants. 

(5) The participants then pool together to recover the secret. They do this by each 
subtracting his random column vector Ni, 2 < i < n, from S. 

Thus, by using n secure channels between the participants, the participants are able to 
compute a secure sum in this secret sharing scheme. For more on the computation of a 
secure sum see [2]. 

3.1. Efficiency. We note that the dealer can efficiently build a word w in the normal 
closure of Pj as a product of arbitrary conjugates of elements of Pj, so that w = 1 in Gj. 
Furthermore, if Cj is a small cancellation group (see our Section [6]), then it is also easy 
to build a word w such that w ^ 1 in Gj: it is sufficient to take care that w does not 
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have more than half of any cyclic permutation of any element of Ri as a subword. See our 
Section [6] for more details. Finally, we note that in small cancellation groups (these are 
the platform groups that we propose in this paper), the word problem has a very efficient 
solution, namely, given a word w in the generators of a small cancellation group G, one 
can determine, in linear time in the length of w, whether or not w = 1 in G. 



4. A (i, n)-THRESHOLD SCHEME 

Here we propose a scheme that combines Shamir's idea with our scheme in Section[3l As 
in Shamir's scheme, the secret is an element x € Z p , and the dealer chooses a polynomial 
/ of degree t — 1 such that /(0) = x. In addition the dealer determines integers = f(i) ( 
mod p) that are to be distributed to participants Pi, 1 < i < n. A set of group generators 
{xi, . . . , x m } is made public. We assume here that all integers x and yi can be written as 
/c-bit columns. Then the scheme is as follows. 

(1) The dealer distributes over a secure channel to each participant Pj a set of rela- 
tors Rj such that each group Gj = (x±, . . . ,x m \Rj) has efficiently solvable word 
problem. 

(2) The dealer then distributes over open channels fc-columns 

(->) 

bj = I , 1 < j < n, of words in x±, . . . ,x m to each participant. The words 

bij are chosen so that, after replacing them by bits (as usual, "1" if fry = 1 in the 
group Gj and "0" otherwise), the resulting bit column represents the integer yj. 

(3) Participant Pj then checks, for each word bij, whether or not bij = 1 in his/her 
group Gj, thus obtaining a binary representation of the number yj, and therefore 
recovering yj. 

(4) Each participant now has a point f(i) = yi of the polynomial. Using polynomial 
interpolation, any t participants can now recover the polynomial /, and hence the 
secret x = /(0). 

If t > 3, then the last step of this protocol can be arranged in such a way that partic- 
ipants do not have to reveal their individual shares yi to each other if they do not want 
to. Indeed, from the Lagrange interpolation formula we see that 

t 



/(o)=i> n 



% — i 

»=1 l<7'<t, 5¥* 

Thus, /(0) is a linear combination of private yi with publicly known coefficients Cj = 
Y\i<j<t j^i 0J- If * > 3, then this linear combination can be computed without revealing 
yi, the same way the sum of private numbers was computed in our Section [3l 

In the special case t = 2, this yields an interesting problem. Note that in the original 
Shamir's scheme, pairs (i, f(i)) of coordinates are sent to participants over secure channels, 
so that the second coordinates are private, whereas the first coordinates are essentially 
public because they just correspond to participants' numbers in an ordering that could be 
publicly known. This, however, does not have to be the case, i.e., the first coordinates can 
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be made private, too, so that the dealer sends private points (xi,f(xi)) to participants. 
Then, for t = 2, we have the following problem of independent interest: 

Problem 1. Given that two participants, Pi and P%, each has a point (xi,yi) in the plane, 
is it possible for them to exchange information in such a way that at the end, they both 
can recover an equation of the line connecting their two points, but neither of them can 
recover precise coordinates of the other participant's point? 

5. Why Use Groups? 

One might ask a natural question at this point: "What is the advantage of using groups 
in this scheme? Why not use just sets of elements Rj as long-term secrets, and then 
distribute elements Wij that either match some elements of Rj or not?" The disadvantage 
of this procedure is that it will eventually compromise the secrecy of Rj because matching 
elements will have to be repeated sooner or later. On the other hand, there are infinitely 
many different words that are equal to 1 in a given group G. For example, if w = 1 in 
G, then also Wih^whi = 1 for any words hi. Thus, the dealer can send as many words 
Wij = 1 in G to the participants as he likes, without having to repeat any word or update 
the relators Rj. 

The question that still remains is whether some information about relators Rj may be 
leaked, even though the words distributed over open channels will never match any words 
in Rj. This is an interesting question of group theory; we address it, to some extent, in 
our Section [3 

6. Platform Group 

In order for our scheme to be practical, we need each participant to have a finite presen- 
tation of a group with efficiently solvable word problem. Here we suggest small cancellation 
groups as a platform for the protocol. For more information on small cancellation groups 
see e.g. [3]. 

Let F(X) be the free group on generators X = {x±, . . . , x n }. A word w(x±, . . . , x n ) = 
x h ' ' ' wnere £i = ±1 for 1 < i < n, is called cyclically reduced if it is a reduced word 
and x^ 1 ^ xy €n . 

A set R containing cyclically reduced words is called symmetrized if it is closed under 
taking cyclic permutations and inverses. Given a set R of relators, a non-empty word 
w € F(X) is called a piece if there are two distinct relators r\,ri £ R such that w is an 
initial segment of both r\ and r% that is, r\ = wv\ and r2 = wvi for some v\,Vi 6 F(X) 
and there is no cancellation between w and v\ or w and V2- 

In the definition below, \w\ denotes the lexicographic length of a word w. 

Definition 1. Let R be a symmetrized set of relators, and let < A < 1. A group 
G = (X;R) with the set X of generators and the set R of relators is said to satisfy the 
small cancellation condition C'(A) if for every r G R such that r = wv and w is a piece, 
one has \w\ < X\r\. In this case, we say that G belongs to the class C (A). 

We propose groups that satisfy the small cancellation property because groups in the 
class C (g) have the word problem efficiently solvable by Dehn's algorithm. The algorithm 
is straightforward: given a word w, look for a subword of w which is a piece of a relator 
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from R of length more than a half of the length of the whole relator. If no such piece 
exists, then w ^ 1 in G. If there is such a piece, say u, then r = uv for some r € R, where 
the length of v is smaller than the length of u. Replace the subword u by v~ l in w, and 
the length of the resulting word will become smaller than that of w. Thus, the algorithm 
must terminate in at most steps. This (original) Dehn's algorithm is therefore easily 
seen to have at most quadratic time complexity with respect to the length of w. We note 
that there is a slightly more elaborate version of Dehn's algorithm that has linear time 
complexity. 

We also note that a generic finitely presented group is a small cancellation group (see 
e.g. [5]); this means, a randomly selected set of relators will define a small cancellation 
group with overwhelming probability. Therefore, to randomly select a small cancellation 
group, the dealer in our scheme can just take a few random words of length > 6 and check 
whether the corresponding symmetrized set satisfies the condition for C'(^). If not, then 
repeat. 

7. TlETZE TRANSFORMATIONS: ELEMENTARY ISOMORPHISMS 

This section is somewhat more technical than the previous ones. Our goal here is 
to show how to break long defining relators in a given group presentation into short 
pieces by using simple isomorphism-preserving transformations. This is useful because 
in a small cancellation presentation (see our Section [6]) defining relators tend to be long 
and, moreover, a word that is equal to 1 in a presentation like that should contain a 
subword which is a piece of a defining relator of length more than a half of the length 
of the whole relator. Therefore, exposing sufficiently many words that are equal to 1 in 
a given presentation may leak information about defining relators. On the other hand, 
if all defining relators are short (of length 3, say), a word that is equal to 1 in such a 
presentation is indistinguishable from random. 

Long time ago, Tietze introduced isomorphism-preserving elementary transformations 
that can be applied to groups presented by generators and defining relators (see e.g. [3]). 
They are of the following types. 

(Tl): Introducing a new generator: Replace (x±, X2, ■ ■ ■ \ r\, . . . ) by 

(y, xi,X2, ... | ys~ , 7*i, r2, • • • ), where s = s(x±,X2, . . . ) is an arbitrary word in the 
generators x\,X2, ■ ■ ■ ■ 

(T2): Canceling a generator (this is the converse of (Tl)): If we have a presentation 
of the form {y, x%,X2, ■ ■ ■ \ q, r\, T2, ■ ■ ■ ), where q is of the form ys _1 , and s, r±, r2, ■ ■ ■ 
are in the group generated by Xi,X2, ■ ■ ■ , replace this presentation by {x±,X2, ... \ 
n,r 2 , ■■■)■ 

(T3): Applying an automorphism: Apply an automorphism of the free group gener- 
ated by x\,X2, ■ ■ ■ to all the relators n, r 2 , ■ ■ ■ ■ 

(T4): Changing defining relators: Replace the set r\,r2, ... of defining relators by 
another set r[, r^, . . . with the same normal closure. That means, each of r±, r 2 , ■ ■ ■ 
should belong to the normal subgroup generated by n, T2, ■ ■ ■ , and vice versa. 

Tietze has proved (see e.g. [3]) that two groups (x%,X2, ... | r\, T2, ■ ■ ■ ) and {x±,X2, ... \ 
s\,S2, ■ ■ ■) are isomorphic if and only if one can get from one of the presentations to the 
other by a sequence of transformations (T1)-(T4). 



A SECRET SHARING SCHEME BASED ON GROUP PRESENTATIONS 



7 



For each Tietze transformation of the types (T1)-(T3), it is easy to obtain an explicit 
isomorphism (as a mapping on generators) and its inverse. For a Tietze transformation 
of the type (T4), the isomorphism is just the identity map. We would like here to make 
Tietze transformations of the type (T4) recursive, because a priori it is not clear how one 
can actually apply these transformations. Thus, we are going to use the following recursive 
version of (T4): 

(T4') In the set ri,T2, replace some rj by one of the: , r^rj, r^rj , rjVi, rjr^ 1 , 
x~ k 1 riXf t , x^riX^ 1 , where j 7^ i, and k is arbitrary. 

Now we explain how the dealer can break down given defining relators into short pieces. 
More specifically, he can replace a given presentation by an isomorphic presentation where 
all defining relators have length at most 3. This is easily achieved by applying transfor- 
mations (Tl) and (T4'), as follows. Let T be a presentation (xi, ■ ■ ■ , Xk] r\, r m ). We are 
going to obtain a different, isomorphic, presentation by using Tietze transformations of 
types (Tl). Specifically, let, say, r\ = XiXjU, 1 < i,j < k. We introduce a new generator 
Xk+i and a new relator r m+ i = x^^XiXj. The presentation 

(xi, . . . , Xk, Xfc+i; r\, . . . , r m , r m+ i) is obviously isomorphic to T. Now if we replace r± with 
r'i = Xk+iu, then the presentation (x\, . . . , Xk, Xfc+i; r[, . . . , r m , r m+ \) will again be iso- 
morphic to r, but now the length of one of the defining relators (r±) has decreased by 
1. Continuing in this manner, one can eventually obtain a presentation where all relators 
have length at most 3, at the expense of introducing more generators. 

We conclude this section with a simple example, just to illustrate how Tietze transforma- 
tions can be used to cut relators into pieces. In this example, we start with a presentation 
having two relators of length 5 in 3 generators, and end up with a presentation having 5 
relators of length 3 in 6 generators. The symbol = below means "is isomorphic to" . 

Example. (x\,X2,X3 \ xfx%, xix^x^^^x^) = (x±, X2, X3, X4 | X4 = x\ , X4X2, xix^x^x^) 

= (XI,X2,X 3 ,X4,X 5 j X 5 =XlX%, X 4 = xj, X±X% X^X^Xz) 

= (XI,X 2 ,X3,X4,X 5 ,X 6 J X 5 = X\X% X 4 = xl, X 6 = X 4 X 2 , XqX% X 5 X^ X 3 ) . 

We note that this procedure of breaking relators into pieces of length 3 increases the 
total length of relators by at most the factor of 2. 

8. Conclusions 

We have proposed a two-stage (t, n)-threshold secret sharing scheme where long-term 
secrets are distributed to participants over secure channels, and then shares of the actual 
secret can be distributed over open channels. 

Our scheme has the same distributed secret as Shamir's scheme does, but rather than 
sending shares of a secret over secure channels, we send the integers in disguise (as tuples of 
words in a public alphabet) over open channels, and then participants use group-theoretic 
methods to recover the integers. This scheme has the following useful advantages over 
Shamir's original scheme: 

• The actual secret need not be distributed over secure channels and, furthermore, 
once the long-term private information is distributed to all participants (over secure 
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channels), several different secrets can be distributed without updating the long- 
term private information. 
• While recovering the secret, participants do not have to reveal their shares to each 
other if they do not want to. 
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